CVE-2020-10123

5.3 MEDIUM
Published: August 21, 2020 Modified: November 04, 2025
View on NVD

Description

The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host computer, allowing an attacker with physical access to internal ATM components to issue valid commands to dispense currency by generating a new session key that the attacker knows.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://kb.cert.org/vuls/id/116713
Source: cret@cert.org
Third Party Advisory US Government Resource
https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secure_white_paper-Dispenser_Security_Solution_September_2018.pdf
Source: cret@cert.org
Exploit Vendor Advisory
https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-10-S1_and_S2_Critical_Update.pdf
Source: cret@cert.org
Vendor Advisory
https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_v5.pdf
Source: cret@cert.org
Vendor Advisory
https://www.ncr.com/content/dam/ncrcom/unsorted/jackpot_attacks_in_the_us_-_january_2018.pdf
Source: cret@cert.org
Vendor Advisory
https://kb.cert.org/vuls/id/116713
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory US Government Resource
https://www.kb.cert.org/vuls/id/116713
Source: af854a3a-2127-422b-91ae-364da2661108
https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secure_white_paper-Dispenser_Security_Solution_September_2018.pdf
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Vendor Advisory
https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-10-S1_and_S2_Critical_Update.pdf
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_v5.pdf
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
https://www.ncr.com/content/dam/ncrcom/unsorted/jackpot_attacks_in_the_us_-_january_2018.pdf
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

11 reference(s) from NVD

Quick Stats

CVSS v3 Score
5.3 / 10.0
EPSS (Exploit Probability)
0.1%
29th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-305 CWE-287

Affected Vendors

ncr

Related CVEs

CVE-2025-52691 10.0
CVE-2025-15168 7.3
CVE-2025-15167 7.3
CVE-2025-15166 7.3
CVE-2025-15165 7.3